1

How can I remove the ability to reset passwords outside of Ubuntu. This probably is ill advised, but I already have set a really good password that I cannot forget with high entropy and 42 characters. I think that it is great that Ubuntu can so easily reset a password, but it seems like a big security risk. (I know you can edit grub, but anyone that knows anything about Linux will just edit the boot command and boot into recovery anyway.) Thanks in advance.

1

Disable the recovery mode by uncommenting the line:

#GRUB_DISABLE_RECOVERY="true"

in /etc/default/grub (and running sudo update-grub afterwards), and password protect grub menu entry.

  • Yeah, that is what I was talking about, though. Can't someone just use a live cd and change that back? – user175999 Jul 17 '13 at 14:17
  • 1
    @user175999 I think I understand your concerns now. You can also passowrd protect the grub menu (answer updated). But there's no definitive solution. Physical access + knowledge = anything is possible. Unless you encrypt your hard disk. – Eric Carvalho Jul 17 '13 at 14:38
  • Even with encrypting with luks, don't most of the necessary files still have to be left unencrypted. i.e. the grub settings and unencrypted /boot? – user175999 Jul 17 '13 at 14:41
  • @user175999 With LUKS , /boot is NOT encrypted. In theory someone could alter or install a custom kernel into /boot, but, they could not change your log in password. I agree with Eric, if someone has physical access you will have a problem. You can look at Truecyrpt or you can put /boot on a flash drive. – Panther Jul 17 '13 at 17:12
  • 1
    In order to prevent booting from a live CD/DVD or USB, you can password protect your BIOS and not allow booting from such devices. – jonnyjandles Oct 4 '17 at 15:51
1

The only way to be sure is to encrypt the disk. Short of that, you have to physically secure the machine so that someone can not remove the HD and plug it into another machine or boot the machine from removable media. Only then does locking down grub do any good.

  • Do you suggest luks or some other way? I guess a Bios Password I suppose as well? – user175999 Jul 17 '13 at 16:20
  • Bios password can (depending on the bios) easily be defeated. +1 to LUKS. – Panther Jul 17 '13 at 17:13
  • @bodhi.zazen, only when you have physical access to open the machine and short the reset jumper, hence the caveat about physical security. – psusi Jul 17 '13 at 18:11
-1

The best way to protect your installation is to apply all the above fixes and lock the PC into a box with ventilation in a room that only you have a key to.

  • Sarcastic answers are not appreciated. Sarcasm is best kept to comments. If you lack the reputation needed to comment, then try asking/answering some questions with good quality. – Daniel Mar 7 '16 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.